CurrentTenant across MicroService #6765

6 Answer(s)

• 

  0

  liangshiwei created 8 months ago

  Support Team Fullstack Developer

  Hi,

  Currently communication between microservices uses client credentials: https://docs.abp.io/en/commercial/latest/startup-templates/microservice/synchronous-interservice-communication

  We have an internal issue with this, may be available in next version

  Save Cancel
• 

  0

  liangshiwei created 8 months ago

  Support Team Fullstack Developer

  if access CurrentTenant property, would it get the same value in Method1

  I think that's fine, ABP will add the current tenant parameters when sending an internal request

  Save Cancel
• 

  0

  DominaTang created 8 months ago

  if access CurrentTenant property, would it get the same value in Method1

  I think that's fine, ABP will add the current tenant parameters when sending an internal request

  Tenant Id currently is in Request header or in access token? I believe UserId are in access token.

  Save Cancel
• 

  0

  liangshiwei created 8 months ago

  Support Team Fullstack Developer

  Hi,

  Tenant Id is in Request header.

  I believe UserId are in access token.

  https://support.abp.io/QA/Questions/6765/CurrentTenant-across-MicroService#answer-3a1109b6-885c-2f65-240c-f25e8d5cd039

  Save Cancel
• 

  0

  liangshiwei created 8 months ago

  Support Team Fullstack Developer

  This is a temporary solution, it should be able to pass the current user's credentials

  You can try override the HttpContextAbpAccessTokenProvider

  [Dependency(ReplaceServices = true)]
  [ExposeServices(typeof(HttpContextAbpAccessTokenProvider), typeof(IAbpAccessTokenProvider))]
  public class MyHttpContextAbpAccessTokenProvider : HttpContextAbpAccessTokenProvider
  {
     ...
     
      public virtual async Task<string?> GetTokenAsync()
      {
          var httpContext = HttpContextAccessor?.HttpContext;
          if (httpContext == null)
          {
              return null;
          }
      
          var token = await httpContext.GetTokenAsync("access_token");
          if (token != null)
          {
              return token;
          }
      
          token = httpContext.Request.Headers["Authorization"];
          if (!token.IsNullOrWhiteSpace() && token.Contains("Bearer "))
          {
              return token.Replace("Bearer ", "");
          }
      
          return null;
      }
  }
  

  Save Cancel
• 

  0

  liangshiwei created 8 months ago

  Support Team Fullstack Developer

  We have an internal issue with this, may be available in next version

  We decided to cancel this because of the following reasons

  This is a request flow as you mentioned:

  

  Assuming WebApp/SwaggerUI is authenticated and got an access_token and making a request to an endpoint at gateway that automatically redirects to the related microservice (MicroserviceA). In this request, MicroserviceA makes a request to the MicroserviceB using HttpApi.Client and client proxy (or gRPC).

  The problem:

  • The request is done by a user, since it is coming from Web; it is either Hybrid flow or AuthorizationCode flow. What if the user with the permission to make a request to MicroserviceA doesn't have permission for the MicroserviceB? If you grant permission to user (or role the user has), it will cause different problems on the UI.

  Microservice terminology:

  Apart from my explanation to this specific approach, the request flow we are discussing is not Synchronous Communication between Microservices

  This is the synchronous communication between microservices:

  

  No UI, no user information; two servers talking to each other.

  We assume, think or design that microservice with authorization. The oidc standarts for this kind interactions should use client_credentials flow. We have related ABP packages to make it easy to use (Abp.IdentityModel) for it. The problem with authorization is Client_Credentials permission type was in the IdentityServer package which shouldn't be specific to IdentityServer. Client_Credentials is valid for all OIDC providers, so we can simply add it to OpenIddict aswell and keep using it.

  Why do we need access_token in the first place?

  Since the synchronous communication between microservices happens in an internal network and moreover, the microservice-to-microservice request maybe slightly or completely different from a UI request; it is better to use Integration Services without caring about authentication. It will be created for the only purpose to server internal requests.

  Save Cancel